@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.js

@@ -1,122 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { openEcdsaRoleLocalSigningMaterialWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
-//#region src/core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.ts
-const persistedMaterialBrand = Symbol("persisted-ecdsa-role-local-material");
-function materialRefMatchesPublicFacts(materialRef, publicFacts) {
-	return materialRef.bindingDigest === publicFacts.contextBinding32B64u;
-}
-function liveHandleMatchesMaterialRef(liveHandle, materialRef) {
-	return liveHandle.durableMaterialRef === materialRef.durableMaterialRef && liveHandle.bindingDigest === materialRef.bindingDigest;
-}
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function corruptResolution(args) {
-	return {
-		kind: "corrupt",
-		purpose: args.purpose,
-		reason: args.reason,
-		message: args.message
-	};
-}
-function resolutionFromRehydrationFailure(args) {
-	switch (args.failure.reason) {
-		case "missing": return {
-			kind: "device_link_required",
-			purpose: args.purpose,
-			reason: "missing_local_material"
-		};
-		case "expired": return corruptResolution({
-			purpose: args.purpose,
-			reason: "expired",
-			message: "ECDSA role-local persisted material has expired"
-		});
-		case "binding_mismatch": return corruptResolution({
-			purpose: args.purpose,
-			reason: "binding_mismatch",
-			message: "ECDSA role-local persisted material binding does not match its public facts"
-		});
-		case "corrupt": return corruptResolution({
-			purpose: args.purpose,
-			reason: "corrupt_persistence",
-			message: "ECDSA role-local persisted material is corrupt"
-		});
-		default: {
-			const exhaustive = args.failure.reason;
-			throw new Error(`Unsupported ECDSA role-local restoration failure: ${String(exhaustive)}`);
-		}
-	}
-}
-function buildPersistedEcdsaRoleLocalMaterial(input) {
-	const authority = parseWalletAuthAuthorityRef(input.authority);
-	if (!authority) throw new Error("ECDSA role-local persisted material authority is invalid");
-	const materialActivationResult = parseMpcMaterialActivationRef(input.materialActivation);
-	if (!materialActivationResult.ok) throw new Error(materialActivationResult.error.message);
-	if (authority.walletId !== input.publicFacts.walletId) throw new Error("ECDSA role-local persisted material authority does not match its wallet");
-	return {
-		[persistedMaterialBrand]: true,
-		kind: "persisted_ecdsa_role_local_material_v1",
-		authority,
-		materialActivation: materialActivationResult.value,
-		publicFacts: input.publicFacts
-	};
-}
-function ecdsaRoleLocalPersistedMaterialSource(persistedMaterial) {
-	return {
-		kind: "persisted",
-		authority: persistedMaterial.authority,
-		materialActivation: persistedMaterial.materialActivation,
-		publicFacts: persistedMaterial.publicFacts
-	};
-}
-async function resolveEcdsaRoleLocalMaterial(input) {
-	switch (input.source.kind) {
-		case "unavailable": return {
-			kind: "device_link_required",
-			purpose: input.purpose,
-			reason: input.source.reason
-		};
-		case "persisted": try {
-			const rehydrated = await openEcdsaRoleLocalSigningMaterialWasm({
-				authority: input.source.authority,
-				materialActivation: input.source.materialActivation,
-				workerCtx: input.workerCtx
-			});
-			if (!rehydrated.ok) return resolutionFromRehydrationFailure({
-				purpose: input.purpose,
-				failure: rehydrated
-			});
-			if (!mpcMaterialActivationRefsEqual(rehydrated.materialRef.materialActivation, input.source.materialActivation) || !materialRefMatchesPublicFacts(rehydrated.materialRef, input.source.publicFacts)) return corruptResolution({
-				purpose: input.purpose,
-				reason: "worker_identity_mismatch",
-				message: "ECDSA role-local worker restored a different material identity"
-			});
-			if (!liveHandleMatchesMaterialRef(rehydrated.liveHandle, rehydrated.materialRef)) return corruptResolution({
-				purpose: input.purpose,
-				reason: "worker_identity_mismatch",
-				message: "ECDSA role-local worker restored a different durable material"
-			});
-			return {
-				kind: "rehydrated",
-				purpose: input.purpose,
-				liveHandle: rehydrated.liveHandle,
-				materialRef: rehydrated.materialRef
-			};
-		} catch (error) {
-			return corruptResolution({
-				purpose: input.purpose,
-				reason: "persistence_unavailable",
-				message: errorMessage(error)
-			});
-		}
-		default: {
-			const exhaustive = input.source;
-			throw new Error(`Unsupported ECDSA role-local material source: ${String(exhaustive)}`);
-		}
-	}
-}
-//#endregion
-export { buildPersistedEcdsaRoleLocalMaterial, ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial };
-
-//# sourceMappingURL=ecdsaRoleLocalMaterialResolver.js.map

package/dist/esm/react/core/signingEngine/session/material/ecdsaSealedRuntime.js

@@ -1,197 +0,0 @@
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
-import { routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest.js";
-//#region src/core/signingEngine/session/material/ecdsaSealedRuntime.ts
-function blocked(reason) {
-	return {
-		kind: "blocked",
-		reason
-	};
-}
-function authMethodForEcdsaSealedSource(source) {
-	switch (source) {
-		case "email_otp": return "email_otp";
-		case "login":
-		case "registration":
-		case "manual-bootstrap": return "passkey";
-		default: throw new Error("[SigningEngine] unsupported sealed ECDSA source");
-	}
-}
-function normalizedNonEmpty(value) {
-	return String(value ?? "").trim();
-}
-/** Exact match on stable material identity. Rotating session and grant
-* identifiers deliberately take no part: they change under a reusable Wallet
-* Session without changing which material this record describes. */
-function sealedRecordNamesManifestMaterial(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	if (normalizedNonEmpty(args.record.walletId) !== String(args.walletId)) return false;
-	if (!thresholdEcdsaChainTargetsEqual(restore.chainTarget, args.chainTarget)) return false;
-	if (!mpcMaterialActivationRefsEqual(restore.roleLocalMaterialRef.materialActivation, durable.materialActivation)) return false;
-	if (!mpcMaterialActivationRefsEqual(durable.materialActivation, args.manifest.activation.materialActivation)) return false;
-	return normalizedNonEmpty(restore.roleLocalMaterialRef.durableMaterialRef) === normalizedNonEmpty(durable.durableMaterialRef);
-}
-function participantIdsEqual(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function authorityRefsEqual(left, right) {
-	return left.kind === right.kind && String(left.walletId) === String(right.walletId) && String(left.authorityDigest) === String(right.authorityDigest);
-}
-function manifestIncludesTarget(args) {
-	return args.manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-}
-function sealedRecordBindsManifestFacts(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	const binding = durable.roleLocalBinding;
-	const publicFacts = durable.roleLocalPublicFacts;
-	const normalScope = restore.routerAbEcdsaDerivationNormalSigning.scope;
-	const expectedAuthMethod = authMethodForEcdsaSealedSource(restore.source);
-	const resolvedThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(normalScope.ecdsa_threshold_key_id);
-	const resolvedClientVerifyingShare = "recordKind" in args.record ? normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) : normalizedNonEmpty(restore.clientVerifyingShareB64u) || normalizedNonEmpty(normalScope.public_identity.derivation_client_share_public_key33_b64u);
-	const resolvedThresholdPublicKey = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(normalScope.public_identity.threshold_public_key33_b64u);
-	return String(args.manifest.signer.walletId) === String(args.walletId) && String(publicFacts.walletId) === String(args.walletId) && manifestIncludesTarget(args) && args.record.authMethod === expectedAuthMethod && authorityRefsEqual(restore.authority, args.manifest.signer.authority) && normalizedNonEmpty(restore.roleLocalMaterialRef.bindingDigest) === normalizedNonEmpty(durable.bindingDigest) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(binding.keyHandle) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(publicFacts.keyHandle) && resolvedThresholdKeyId === normalizedNonEmpty(binding.ecdsaThresholdKeyId) && resolvedThresholdKeyId === normalizedNonEmpty(publicFacts.ecdsaThresholdKeyId) && resolvedClientVerifyingShare === normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) && resolvedClientVerifyingShare === normalizedNonEmpty(publicFacts.derivationClientSharePublicKey33B64u) && resolvedThresholdPublicKey === normalizedNonEmpty(publicFacts.groupPublicKey33B64u) && normalizedNonEmpty(restore.relayerKeyId) === normalizedNonEmpty(binding.relayerKeyId) && participantIdsEqual(restore.participantIds, binding.participantIds) && participantIdsEqual(restore.participantIds, publicFacts.participantIds) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(args.manifest.signer.signingRootId) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(publicFacts.signingRootId) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(args.manifest.signer.signingRootVersion) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(publicFacts.signingRootVersion) && normalizedNonEmpty(restore.ethereumAddress).toLowerCase() === normalizedNonEmpty(publicFacts.ethereumAddress).toLowerCase() && routerAbEcdsaDerivationPublicCapabilitiesEqual(restore.publicCapability, publicFacts.publicCapability) && sameRouterAbEcdsaDerivationNormalSigningScopeV1(normalScope, {
-		wallet_id: String(args.walletId),
-		ecdsa_threshold_key_id: String(publicFacts.ecdsaThresholdKeyId),
-		signing_root_id: String(publicFacts.signingRootId),
-		signing_root_version: String(publicFacts.signingRootVersion),
-		context: publicFacts.publicCapability.context,
-		public_identity: publicFacts.publicCapability.public_identity,
-		signing_worker: publicFacts.publicCapability.signer_set.selected_server,
-		activation_epoch: publicFacts.publicCapability.activation_epoch,
-		material_activation: routerAbMpcMaterialActivationRefToWire(durable.materialActivation)
-	});
-}
-function authBindingFromRestore(args) {
-	const restore = args.restore;
-	if (restore.source === "email_otp") {
-		const providerSubjectId = normalizedNonEmpty(restore.providerSubjectId);
-		const emailHashHex = normalizedNonEmpty(restore.emailHashHex);
-		const sealedAuthority = restore.emailOtpAuthority;
-		const manifestAuthority = args.manifest.signer.authority;
-		if (!providerSubjectId || !emailHashHex || !sealedAuthority || String(sealedAuthority.walletId) !== String(manifestAuthority.walletId) || String(sealedAuthority.factor.providerUserId) !== providerSubjectId || String(sealedAuthority.verifier.emailHashHex) !== emailHashHex) return null;
-		return {
-			kind: "email_otp",
-			providerSubjectId,
-			emailHashHex,
-			emailOtpAuthority: {
-				walletId: sealedAuthority.walletId,
-				factor: sealedAuthority.factor,
-				verifier: sealedAuthority.verifier,
-				bindingId: manifestAuthority.walletAuthMethodId
-			}
-		};
-	}
-	const rpId = normalizedNonEmpty(restore.rpId);
-	const credentialIdB64u = normalizedNonEmpty(restore.credentialIdB64u);
-	return rpId && credentialIdB64u ? {
-		kind: "passkey",
-		rpId,
-		credentialIdB64u
-	} : null;
-}
-function exactTwoPartyParticipantIds(value) {
-	if (value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) return null;
-	return [first, second];
-}
-function materialRuntimeFromRecord(args) {
-	const restore = args.record.ecdsaRestore;
-	const authBinding = authBindingFromRestore({
-		manifest: args.manifest,
-		restore
-	});
-	const relayerUrl = normalizedNonEmpty(args.record.relayerUrl).replace(/\/+$/g, "");
-	const relayerKeyId = normalizedNonEmpty(restore.relayerKeyId);
-	const clientVerifyingPublicKey33B64u = args.manifest.durableMaterial.roleLocalBinding.clientVerifyingPublicKey33B64u;
-	const ecdsaThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.ecdsa_threshold_key_id);
-	const thresholdEcdsaPublicKeyB64u = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.public_identity.threshold_public_key33_b64u);
-	const keyHandle = normalizedNonEmpty(restore.keyHandle);
-	const participantIds = Array.isArray(restore.participantIds) ? exactTwoPartyParticipantIds(restore.participantIds) : null;
-	let roleLocalMaterialRef;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef);
-	} catch {
-		return null;
-	}
-	let runtimePolicyScope = null;
-	try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(restore.runtimePolicyScope);
-	} catch {
-		runtimePolicyScope = null;
-	}
-	if (!authBinding || !relayerUrl || !relayerKeyId || !clientVerifyingPublicKey33B64u || !ecdsaThresholdKeyId || !thresholdEcdsaPublicKeyB64u || !keyHandle || !participantIds) return null;
-	return {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		materialActivation: restore.roleLocalMaterialRef.materialActivation,
-		normalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-		relayerUrl,
-		relayerKeyId,
-		clientVerifyingPublicKey33B64u,
-		participantIds,
-		ecdsaThresholdKeyId,
-		thresholdEcdsaPublicKeyB64u,
-		keyHandle,
-		runtimePolicyScope,
-		roleLocalMaterialRef,
-		authBinding
-	};
-}
-function runtimeFromSealedRecord(args) {
-	const materialRuntime = materialRuntimeFromRecord(args);
-	const expiresAtMs = Number(args.record.expiresAtMs);
-	const remainingUses = Number(args.record.remainingUses);
-	const thresholdSessionId = normalizedNonEmpty(args.record.thresholdSessionIds.ecdsa);
-	const storeKey = normalizedNonEmpty(args.record.storeKey);
-	if (!materialRuntime || !storeKey || !thresholdSessionId || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || !Number.isSafeInteger(remainingUses) || remainingUses < 0) return null;
-	return {
-		...materialRuntime,
-		kind: "exact_ecdsa_sealed_runtime_v1",
-		expiresAtMs,
-		remainingUses,
-		sealedRecord: {
-			storeKey,
-			thresholdSessionId,
-			authMethod: args.record.authMethod
-		}
-	};
-}
-function resolveExactEcdsaSealedRuntime(input) {
-	const matches = input.sealedRecords.filter((record) => sealedRecordNamesManifestMaterial({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record
-	}));
-	if (matches.length === 0) return blocked("missing_material");
-	if (matches.length > 1) return blocked("exact_record_conflict");
-	const runtime = runtimeFromSealedRecord({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	});
-	if (!runtime) return blocked("corrupt");
-	if (!sealedRecordBindsManifestFacts({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	})) return blocked("binding_mismatch");
-	return {
-		kind: "resolved",
-		runtime
-	};
-}
-//#endregion
-export { resolveExactEcdsaSealedRuntime };
-
-//# sourceMappingURL=ecdsaSealedRuntime.js.map

package/dist/esm/react/core/signingEngine/session/material/ecdsaSigningCapability.js

@@ -1,231 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-//#region src/core/signingEngine/session/material/ecdsaSigningCapability.ts
-function exactEcdsaSubjectMatches(args) {
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
-}
-function targetMatchesCapability(args) {
-	return args.capability.manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-}
-function participantIdsMatch(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function selectedAuthorityComponentsAreExact(args) {
-	const { selectedAuthority, selectedAuthMethod } = args;
-	return selectedAuthMethod.walletId === args.walletId && selectedAuthMethod.status === "active" && selectedAuthMethod.walletAuthorityId === selectedAuthority.authorityId && selectedAuthority.walletId === args.walletId && selectedAuthority.state === "active";
-}
-function capabilityAuthorityMatchesRuntime(args) {
-	const capabilityAuthority = args.capability.authority;
-	const runtimeBinding = args.runtime.authBinding;
-	switch (runtimeBinding.kind) {
-		case "email_otp": return isEmailOtpWalletAuthAuthority(capabilityAuthority) && walletAuthAuthoritiesMatch(capabilityAuthority, runtimeBinding.emailOtpAuthority);
-		case "passkey": return isPasskeyWalletAuthAuthority(capabilityAuthority) && capabilityAuthority.verifier.rpId === runtimeBinding.rpId && capabilityAuthority.factor.credentialIdB64u === runtimeBinding.credentialIdB64u;
-		default: return runtimeBinding;
-	}
-}
-function selectedAuthMethodMatchesRuntime(args) {
-	switch (args.runtime.authBinding.kind) {
-		case "email_otp": return args.selectedAuthMethod.kind === "email_otp" && args.selectedAuthMethod.emailHashHex === args.runtime.authBinding.emailHashHex;
-		case "passkey": return args.selectedAuthMethod.kind === "passkey" && String(args.selectedAuthMethod.rpId) === String(args.runtime.authBinding.rpId) && args.selectedAuthMethod.credentialIdB64u === args.runtime.authBinding.credentialIdB64u;
-		default: return args.runtime.authBinding;
-	}
-}
-function exactAuthorizationMatchesCapability(args) {
-	if (!Number.isSafeInteger(args.nowMs) || args.nowMs < 0) return false;
-	const { capability, authorization } = args;
-	const session = authorization.session;
-	const operationCredential = authorization.operationCredential;
-	const runtime = authorization.runtime;
-	const signer = capability.manifest.signer;
-	const activation = authorization.selectedAuthority.signerActivations.ecdsa;
-	if (!activation) return false;
-	if (!selectedAuthorityComponentsAreExact({
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		walletId: session.walletId
-	})) return false;
-	if (session.walletId !== signer.walletId || session.authorityId !== authorization.selectedAuthority.authorityId || session.authMethodId !== authorization.selectedAuthMethod.walletAuthMethodId || session.authorityDigestB64u !== authorization.selectedAuthority.authorityDigestB64u || session.authorityRevocationEpoch !== authorization.selectedAuthority.revocationEpoch || signer.authority.walletId !== authorization.selectedAuthority.walletId || signer.authority.walletAuthMethodId !== authorization.selectedAuthMethod.walletAuthMethodId || session.authorizationId.trim().length === 0 || session.quotaId.trim().length === 0 || operationCredential.walletSessionId.trim().length === 0 || operationCredential.token.trim().length === 0 || runtime.walletId !== session.walletId || !selectedAuthMethodMatchesRuntime({
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		runtime
-	}) || !mpcMaterialActivationRefsEqual(runtime.materialActivation, capability.manifest.activation.materialActivation) || !mpcMaterialActivationRefsEqual(runtime.roleLocalMaterialRef.materialActivation, runtime.materialActivation) || !targetMatchesCapability({
-		capability,
-		chainTarget: runtime.chainTarget
-	}) || !capabilityAuthorityMatchesRuntime({
-		capability,
-		runtime
-	}) || !exactEcdsaSubjectMatches({
-		session,
-		materialActivation: capability.manifest.activation.materialActivation
-	}) || !mpcMaterialActivationRefsEqual(activation.materialActivation, capability.manifest.activation.materialActivation) || activation.signer.walletId !== session.walletId || runtime.expiresAtMs <= 0 || !Number.isSafeInteger(runtime.remainingUses) || runtime.remainingUses < 0) return false;
-	switch (runtime.kind) {
-		case "exact_ecdsa_direct_capability_runtime_v1": break;
-		case "exact_ecdsa_sealed_runtime_v1":
-			if (runtime.sealedRecord.authMethod !== authorization.selectedAuthMethod.kind || runtime.sealedRecord.storeKey.trim().length === 0 || runtime.sealedRecord.thresholdSessionId.trim().length === 0) return false;
-			break;
-		default: return runtime;
-	}
-	if (session.expiresAtMs <= args.nowMs || runtime.expiresAtMs <= args.nowMs) return false;
-	if (runtime.keyHandle !== String(capability.material.publicFacts.keyHandle) || runtime.ecdsaThresholdKeyId !== String(capability.material.publicFacts.ecdsaThresholdKeyId) || runtime.thresholdEcdsaPublicKeyB64u !== String(capability.material.publicFacts.groupPublicKey33B64u) || !participantIdsMatch(runtime.participantIds, capability.material.publicFacts.participantIds)) return false;
-	return true;
-}
-function isExactPasskeyWalletSessionRuntime(runtime) {
-	return runtime.authBinding.kind === "passkey";
-}
-function isExactEmailOtpWalletSessionRuntime(runtime) {
-	return runtime.authBinding.kind === "email_otp";
-}
-function buildPreprocessingSessionBinding(input) {
-	if (isExactPasskeyWalletSessionRuntime(input.runtime) && input.selected.authMethod.kind === "passkey") return {
-		kind: "ecdsa_preprocessing_session",
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		session: input.session,
-		operationCredential: input.operationCredential,
-		runtime: input.runtime
-	};
-	if (isExactEmailOtpWalletSessionRuntime(input.runtime) && input.selected.authMethod.kind === "email_otp") return {
-		kind: "ecdsa_preprocessing_session",
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		session: input.session,
-		operationCredential: input.operationCredential,
-		runtime: input.runtime
-	};
-	throw new Error("ECDSA preprocessing session auth method is inconsistent");
-}
-function directRuntimeAuthBinding(authority) {
-	if (isPasskeyWalletAuthAuthority(authority)) return {
-		kind: "passkey",
-		rpId: String(authority.verifier.rpId),
-		credentialIdB64u: String(authority.factor.credentialIdB64u)
-	};
-	if (isEmailOtpWalletAuthAuthority(authority)) return {
-		kind: "email_otp",
-		providerSubjectId: String(authority.factor.providerUserId),
-		emailHashHex: String(authority.verifier.emailHashHex),
-		emailOtpAuthority: authority
-	};
-	return authority;
-}
-function buildExactEcdsaDirectCapabilityRuntime(args) {
-	if (!Number.isSafeInteger(args.status.expiresAtMs) || args.status.expiresAtMs <= 0 || !Number.isSafeInteger(args.status.remainingUses) || args.status.remainingUses < 0) throw new Error("Exact ECDSA direct capability requires valid session facts");
-	return {
-		kind: "exact_ecdsa_direct_capability_runtime_v1",
-		walletId: args.runtime.walletId,
-		chainTarget: args.runtime.chainTarget,
-		materialActivation: args.runtime.materialActivation,
-		normalSigning: args.runtime.normalSigning,
-		relayerUrl: args.runtime.relayerUrl,
-		relayerKeyId: args.runtime.relayerKeyId,
-		clientVerifyingPublicKey33B64u: args.runtime.clientVerifyingPublicKey33B64u,
-		participantIds: args.runtime.participantIds,
-		ecdsaThresholdKeyId: args.runtime.ecdsaThresholdKeyId,
-		thresholdEcdsaPublicKeyB64u: args.runtime.thresholdEcdsaPublicKeyB64u,
-		keyHandle: args.runtime.keyHandle,
-		runtimePolicyScope: args.runtime.runtimePolicyScope,
-		roleLocalMaterialRef: args.runtime.roleLocalMaterialRef,
-		authBinding: directRuntimeAuthBinding(args.authority),
-		expiresAtMs: args.status.expiresAtMs,
-		remainingUses: args.status.remainingUses
-	};
-}
-function exactEcdsaAuthBindingsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "email_otp": return right.kind === "email_otp" && left.providerSubjectId === right.providerSubjectId && left.emailHashHex === right.emailHashHex && walletAuthAuthoritiesMatch(left.emailOtpAuthority, right.emailOtpAuthority);
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
-		default: return left;
-	}
-}
-function exactEcdsaWalletSessionRuntimesMatch(left, right) {
-	if (left.kind !== right.kind || left.walletId !== right.walletId || !thresholdEcdsaChainTargetsEqual(left.chainTarget, right.chainTarget) || !mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) || left.keyHandle !== right.keyHandle || left.ecdsaThresholdKeyId !== right.ecdsaThresholdKeyId || !exactEcdsaAuthBindingsMatch(left.authBinding, right.authBinding)) return false;
-	switch (left.kind) {
-		case "exact_ecdsa_direct_capability_runtime_v1": return right.kind === "exact_ecdsa_direct_capability_runtime_v1";
-		case "exact_ecdsa_sealed_runtime_v1": return right.kind === "exact_ecdsa_sealed_runtime_v1" && left.sealedRecord.authMethod === right.sealedRecord.authMethod && left.sealedRecord.storeKey === right.sealedRecord.storeKey && left.sealedRecord.thresholdSessionId === right.sealedRecord.thresholdSessionId;
-		default: return left;
-	}
-}
-function validateExactSessionAuthorization(input) {
-	const walletId = input.session.walletId;
-	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < 0) throw new Error("Exact EVM-family Wallet Session authorization requires a valid timestamp");
-	if (!selectedAuthorityComponentsAreExact({
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		walletId
-	}) || input.selected.selection.walletId !== walletId || input.selected.selection.walletAuthMethodId !== input.selected.authMethod.walletAuthMethodId || input.selected.selection.lockState !== "unlocked") throw new Error("Exact EVM-family Wallet Session authorization selected authority is invalid");
-	const authorization = buildPreprocessingSessionBinding(input);
-	if (!exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization,
-		nowMs: input.nowMs
-	})) throw new Error("Exact EVM-family Wallet Session authorization identity is inconsistent");
-	return authorization;
-}
-function buildExactEvmFamilyWalletSessionAuthorization(input) {
-	const authorization = signingAuthorizationFromPreprocessing(buildEcdsaPreprocessingCapability(input), input.nowMs);
-	if (!authorization) throw new Error("Exact ECDSA signing authorization requires remaining signing uses");
-	return authorization;
-}
-function buildEcdsaPreprocessingCapability(input) {
-	return {
-		kind: "authorized_ecdsa_preprocessing_capability",
-		capability: input.capability,
-		authorization: validateExactSessionAuthorization(input)
-	};
-}
-function signingAuthorizationFromPreprocessing(input, nowMs) {
-	const authorization = input.authorization;
-	const runtime = authorization.runtime;
-	if (runtime.remainingUses <= 0 || !exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization,
-		nowMs
-	})) return null;
-	if (isExactPasskeyWalletSessionRuntime(runtime) && authorization.selectedAuthMethod.kind === "passkey") return {
-		kind: "exact_evm_family_wallet_session_authorization_v1",
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		session: authorization.session,
-		operationCredential: authorization.operationCredential,
-		runtime
-	};
-	if (isExactEmailOtpWalletSessionRuntime(runtime) && authorization.selectedAuthMethod.kind === "email_otp") return {
-		kind: "exact_evm_family_wallet_session_authorization_v1",
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		session: authorization.session,
-		operationCredential: authorization.operationCredential,
-		runtime
-	};
-	return null;
-}
-function authorizeEvmFamilyEcdsaSigningCapability(input) {
-	if (input.authorization.runtime.remainingUses <= 0 || !exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization: input.authorization,
-		nowMs: input.nowMs
-	})) throw new Error("Exact Wallet Session authorization does not bind the ECDSA signing capability");
-	return {
-		kind: "authorized_evm_family_ecdsa_signing_capability",
-		capability: input.capability,
-		authorization: input.authorization
-	};
-}
-async function buildCanonicalEvmFamilyEcdsaSigningCapability(input) {
-	const signer = input.manifest.signer;
-	const registeredPublicFacts = signer.registeredPublicFacts;
-	const materialPublicFacts = input.material.publicFacts;
-	const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
-	if (authorityRef.authorityDigest !== signer.authority.authorityDigest || authorityRef.walletId !== signer.walletId || input.material.authority.walletId !== signer.walletId || input.material.authority.authorityDigest !== signer.authority.authorityDigest || !mpcMaterialActivationRefsEqual(input.material.materialActivation, input.manifest.activation.materialActivation) || materialPublicFacts.walletId !== signer.walletId || materialPublicFacts.keyHandle !== registeredPublicFacts.keyHandle || String(materialPublicFacts.groupPublicKey33B64u) !== String(registeredPublicFacts.publicKeyB64u) || materialPublicFacts.ethereumAddress !== registeredPublicFacts.thresholdOwnerAddress || materialPublicFacts.participantIds.length !== registeredPublicFacts.participantIds.length || materialPublicFacts.participantIds.some((participantId, index) => participantId !== registeredPublicFacts.participantIds[index])) throw new Error("Canonical EVM-family ECDSA signing capability identity is inconsistent");
-	return {
-		kind: "canonical_evm_family_ecdsa_signing_capability",
-		authority: input.authority,
-		manifest: input.manifest,
-		material: input.material
-	};
-}
-//#endregion
-export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
-
-//# sourceMappingURL=ecdsaSigningCapability.js.map

package/dist/esm/react/core/signingEngine/session/material/linkedEcdsaHolderRuntime.js

@@ -1,36 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-//#region src/core/signingEngine/session/material/linkedEcdsaHolderRuntime.ts
-const linkedHolderRuntimes = /* @__PURE__ */ new Map();
-function runtimeKey(input) {
-	return `${String(input.walletId)}\0${input.materialActivation.activationId}`;
-}
-function installLinkedEcdsaHolderRuntimeV1(runtime) {
-	const key = runtimeKey(runtime);
-	const existing = linkedHolderRuntimes.get(key);
-	if (existing && (existing.authorityId !== runtime.authorityId || existing.walletAuthMethodId !== runtime.walletAuthMethodId || existing.factorAuthority.walletId !== runtime.factorAuthority.walletId || existing.factorAuthority.bindingId !== runtime.factorAuthority.bindingId || existing.holderHandleId !== runtime.holderHandleId || !mpcMaterialActivationRefsEqual(existing.materialActivation, runtime.materialActivation))) throw new Error("linked ECDSA holder runtime conflicts with the active authority");
-	linkedHolderRuntimes.set(key, runtime);
-}
-function resolveLinkedEcdsaHolderRuntimeV1(input) {
-	return linkedHolderRuntimes.get(runtimeKey(input)) ?? null;
-}
-function listLinkedEcdsaHolderRuntimesV1(walletId) {
-	return [...linkedHolderRuntimes.values()].filter((runtime) => walletId === void 0 || runtime.walletId === walletId);
-}
-function removeLinkedEcdsaHolderRuntimeV1(input) {
-	const key = runtimeKey(input);
-	const runtime = linkedHolderRuntimes.get(key);
-	if (!runtime) return;
-	if (runtime.holderHandleId !== input.holderHandleId) throw new Error("linked ECDSA holder runtime changed before removal");
-	linkedHolderRuntimes.delete(key);
-}
-function clearLinkedEcdsaHolderRuntimesV1(walletId) {
-	if (!walletId) {
-		linkedHolderRuntimes.clear();
-		return;
-	}
-	for (const [key, runtime] of linkedHolderRuntimes) if (runtime.walletId === walletId) linkedHolderRuntimes.delete(key);
-}
-//#endregion
-export { clearLinkedEcdsaHolderRuntimesV1, installLinkedEcdsaHolderRuntimeV1, listLinkedEcdsaHolderRuntimesV1, removeLinkedEcdsaHolderRuntimeV1, resolveLinkedEcdsaHolderRuntimeV1 };
-
-//# sourceMappingURL=linkedEcdsaHolderRuntime.js.map

package/dist/esm/react/core/signingEngine/session/material/mpcCapabilityHydration.js

@@ -1,79 +0,0 @@
-//#region src/core/signingEngine/session/material/mpcCapabilityHydration.ts
-var MpcHydrationProof = class {
-	retainProof() {
-		return true;
-	}
-	constructor() {
-		this.retainProof();
-	}
-};
-var MpcUseLiveRuntimeHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "use_live_runtime";
-		this.capability = fields.materialActivation.capability;
-		this.materialOwner = fields.materialActivation.materialOwner;
-		this.authority = fields.authority;
-		this.runtime = fields.runtime;
-		this.materialActivation = fields.materialActivation;
-	}
-};
-var MpcRehydrateMaterialActivationHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "rehydrate_material_activation";
-		this.capability = fields.materialActivation.capability;
-		this.materialOwner = fields.materialActivation.materialOwner;
-		this.authority = fields.authority;
-		this.materialActivation = fields.materialActivation;
-		this.sealedMaterial = fields.sealedMaterial;
-	}
-};
-var MpcReauthorizePublicAnchorHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "reauthorize_public_anchor";
-		this.capability = fields.publicReauthAnchor.capability;
-		this.materialOwner = fields.publicReauthAnchor.materialOwner;
-		this.authority = fields.publicReauthAnchor.authority;
-		this.retirement = fields.retirement;
-		this.publicReauthAnchor = fields.publicReauthAnchor;
-	}
-};
-var MpcBlockedCapabilityHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(..._args) {
-		super(..._args);
-		this.kind = "blocked";
-	}
-};
-var MpcMissingCapabilityHydrationPlanProof = class extends MpcBlockedCapabilityHydrationPlanProof {
-	constructor(..._args2) {
-		super(..._args2);
-		this.capability = null;
-		this.reason = "missing_capability";
-	}
-};
-var MpcKnownCapabilityBlockedHydrationPlanProof = class extends MpcBlockedCapabilityHydrationPlanProof {
-	constructor(fields) {
-		super();
-		this.capability = fields.capability;
-		this.reason = fields.reason;
-	}
-};
-function buildUseLiveRuntimeHydrationPlan(fields) {
-	return new MpcUseLiveRuntimeHydrationPlanProof(fields);
-}
-function buildRehydrateMaterialActivationHydrationPlan(fields) {
-	return new MpcRehydrateMaterialActivationHydrationPlanProof(fields);
-}
-function buildReauthorizePublicAnchorHydrationPlan(fields) {
-	return new MpcReauthorizePublicAnchorHydrationPlanProof(fields);
-}
-function buildBlockedMpcCapabilityHydrationPlan(fields) {
-	if (fields.reason === "missing_capability") return new MpcMissingCapabilityHydrationPlanProof();
-	return new MpcKnownCapabilityBlockedHydrationPlanProof(fields);
-}
-//#endregion
-export { buildBlockedMpcCapabilityHydrationPlan, buildReauthorizePublicAnchorHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan };
-
-//# sourceMappingURL=mpcCapabilityHydration.js.map